Vulnerability · Published Jun 22, 2026 · Assigned by VulnCheck

CVE-2026-56280Cap-go - Privilege Inversion in Build Log Stream via SSE Disconnect

High 7.1

In plain English

A high-severity missing authorization in capgo from Cap-go. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.3%top 75.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Cap-go before 12.128.2 contains a privilege inversion vulnerability in GET /build/logs/:jobId that allows read-only API key holders to cancel running native builds. The endpoint registers an abort listener on the SSE stream that unconditionally invokes cancelBuildOnDisconnect() using the privileged server-side BUILDER_API_KEY when clients disconnect, bypassing the app.build_native permission check required by the explicit POST /build/cancel/:jobId endpoint. Attackers with read-only API keys can repeatedly disrupt native build operations and CI/CD workflows by opening the log stream and dropping the connection.

Affected products (as reported)

Vendor	Product	Versions
Cap-go	capgo	0 – before 12.128.2

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

References

GitHub Security Advisory (GHSA-95g7-xwwx-j737) vendor-advisory
VulnCheck Advisory: Cap-go - Privilege Inversion in Build Log Stream via SSE Disconnect third-party-advisory